@angular/ssr
22.2.3 · 15 Oct 2026MIT315.4k / weekRepositorynpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @angular/ssr. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 22.2.3 | Safe from 22.1.7 | |
| 21.2.27 | Safe from 21.2.23 | |
| 20.3.40 | Safe from 20.3.36 | |
| 19.2.27 | 1 open advisory, worst moderate | |
| 18.2.21 | 5 open advisories, worst critical · last release Sep 2025, no longer updated |
- CriticalAngular SSR is vulnerable to SSRF and Header Injection via request handling pipelineGHSA-x288-3778-4hhx · 25 Feb 2026
- 21.x21.0.0 – 21.1.4Fixed in 21.1.5
- 20.x20.0.0 – 20.3.16Fixed in 20.3.17
- 19.x19.0.0 – 19.2.20Fixed in 19.2.21
- 18.x and older17.0.0 – 18.2.21No fix, no longer updated · move to 19.2.21
- HighAngular SSR has a Server-Side Request Forgery (SSRF) flawGHSA-q63q-pgmf-mxhr · 16 Oct 2025
- 20.x20.0.0 – 20.3.5Fixed in 20.3.6
- 19.x19.0.0 – 19.2.17Fixed in 19.2.18
- HighAngular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data LeakageGHSA-68x2-mx4q-78m7 · 10 Sep 2025
- 20.x20.0.0 – 20.2.2Fixed in 20.3.0
- 19.x19.0.0 – 19.2.15Fixed in 19.2.16
- 18.x18.0.0 – 18.2.20Fixed in 18.2.21
- 17.x17.0.0 – 17.3.17No fix on 17.x · move to 18.2.21
- ModerateAngular SSR: Path Traversal to Sibling Directories in CommonEngine on WindowsGHSA-7g7c-h8rr-7p6q · 5 Oct 2026
- 22.x22.0.0 – 22.1.6Fixed in 22.1.7
- 21.x21.0.0 – 21.2.22Fixed in 21.2.23
- 20.x20.0.0 – 20.3.35Fixed in 20.3.36
- 19.x19.0.0 – 19.2.27No fix on 19.x · move to 20.3.36
- 18.x and older17.0.0 – 18.2.21No fix, no longer updated · move to 20.3.36
- ModerateAngular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-PrefixGHSA-69xr-m8h6-h664 · 6 May 2026
- 21.x21.0.0 – 21.2.8Fixed in 21.2.9
- 20.x20.0.0 – 20.3.24Fixed in 20.3.25
- 19.x19.0.0 – 19.2.24Fixed in 19.2.25
- ModerateProtocol-Relative URL Injection via Single Backslash Bypass in Angular SSRGHSA-vfx2-hv2g-xj5f · 19 Mar 2026
- 21.x21.0.0 – 21.2.2Fixed in 21.2.3
- 20.x20.0.0 – 20.3.20Fixed in 20.3.21
- ModerateAngular SSR has an Open Redirect via X-Forwarded-PrefixGHSA-xh43-g2fq-wjrj · 25 Feb 2026
- 21.x21.0.0 – 21.1.4Fixed in 21.1.5
- 20.x20.0.0 – 20.3.16Fixed in 20.3.17
- 19.x19.0.0 – 19.2.20Fixed in 19.2.21
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.